# 24 Physical and environmental security policy

| | |
| --- | --- |
| Version | 0.1 draft |
| Owner | Infrastructure Owner |
| Review | Yearly |
| Applies to | Locations of production hardware, offices, and devices used to reach in-scope systems |

## Production hardware

1. In-scope production runs in facilities operated by a subservice organization with its own SOC 2 Type II or ISO 27001 report covering physical access, environmental protection (power, cooling, fire, flood), and hardware disposal (ACC-15, AVL-06). Rang & Mall does not operate in-scope production hardware in an office or a residence.
2. The provider's report is reviewed yearly under [22](/soc2/22-vendor-management) and the review notes any exception related to physical or environmental controls.
3. If production ever runs on hardware Rang & Mall owns, it is in a colocation facility meeting point 1, with dedicated hardware, encrypted disks, and an access list kept by the facility.

## Offices and remote work

1. Development machines and laptops are protected by the endpoint baseline in [11](/soc2/11-conduct-acceptable-use): disk encryption, screen lock, updates.
2. Screens showing customer data are not visible to visitors or in public places.
3. Paper with customer data is not printed except where a customer process requires it, and is shredded after use.
4. Visitors to an office where development machines are kept are accompanied.

## Equipment off-site and disposal

Devices taken off-site are under the owner's control at all times. Disposal follows [14](/soc2/14-asset-data-management#disposal-of-media).